CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a crafted series of skip and count pairs.
In ntpd versions before 4.2.8p9, when running on Windows, there is a vulnerability that allows remote attackers to cause a denial of service by sending a large UDP packet.
The OTR plugin for Gajim sends information in cleartext when using XHTML, allowing remote attackers to obtain sensitive information.
The read_mru_list function in NTP before version 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.
NTP versions before 4.2.8p9 rate limit responses received from configured sources when rate limiting for all associations is enabled. This allows remote attackers to cause a denial of service by sending responses with a spoofed source address.
The pstm_reverse function in MatrixSSL before version 3.8.4 allows remote attackers to cause a denial of service (invalid memory read and crash) via a zero value or the key's modulus for the secret key during RSA key exchange.
The pstm_exptmod function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid free and crash) via a base zero value for the modular exponentiation.
CVE-2016-2090 describes an off-by-one vulnerability in the fgetwln function in libbsd before version 0.8.2, allowing attackers to trigger a heap-based buffer overflow via unspecified vectors.
The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.
Memory corruption vulnerability in Foxit PDF Toolkit v1.3 allows an attacker to cause Denial of Service and Remote Code Execution when the victim opens a specially crafted PDF file.
An issue was discovered in Cloud Foundry prior to version v250 and CAPI-release prior to v1.12.0 related to logging credentials returned from service brokers. These credentials are logged in Cloud Controller system component logs and often sent to a log aggregator via syslog.
CVE-2016-3130 is an information disclosure vulnerability in BlackBerry Enterprise Server (BES) 12 through 12.5.2 that allows remote attackers to obtain local or domain credentials of an administrator or user account by sniffing traffic between the management console and the server during a login attempt.
CVE-2016-3128 is a vulnerability in BlackBerry Enterprise Server (BES) 12 through 12.5.2 that allows remote attackers to enroll an illegitimate device, gain access to device parameters, or send false information by exploiting data from a legitimately enrolled device.
An integer overflow vulnerability was observed in the regemit function in regexp.c in MuJS by Artifex Software, Inc. It requires a regular expression with nested repetition, which can lead to code execution or a denial of service (buffer overflow) condition.
An information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 and v1.29, allowing a remote unauthenticated attacker to browse all directories in the web root.
An issue was discovered on BLU R1 HD devices with Shanghai Adups software related to the com.adups.fota and com.adups.fota.sysoper apps. The com.adups.fota.sysoper app runs as the system user, granting it numerous permissions, including access to the user's call log, text messages, and device identifiers.
An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software related to the com.adups.fota.sysoper app, which operates as a system app. This app has an exported broadcast receiver, allowing other apps to interact with it and execute commands with system user privileges.
An issue was discovered on BLU R1 HD devices with Shanghai Adups software that allows apps to access files as the system user. The com.adups.fota.sysoper app enables other apps to read, write, and delete files, including users' text messages and call logs.
An issue was discovered on BLU R1 HD devices with Shanghai Adups software that allows apps to access files as the system user. The com.adups.fota.sysoper app sets the android:sharedUserId attribute to android.uid.system, enabling other apps to read, write, and delete system files.
The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.